Rethinking Risk, Governance, and Compliance Applying Automation
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 15:15· HALL 2, New York, NY, USA·
summary
Argues that release authorization becomes objective by capturing signed SDLC attestations, using Sigstore, in-toto/SLSA provenance and Open Policy Agent for policy decisions. Shows a demo dashboard that links commits to attestations, stores signatures in a tamper‑evident ledger, and blocks production deploys when policies fail. Gives a concrete example: unit‑test policy set to 80% while an attestation records 91% coverage, and describes automated enforcement forcing teams to self‑migrate pipeline libraries rather than manual change boards.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:58Background
- 1:39Building Software is Complex
- 1:59The Path to Release
- 2:26What is Automated Governance
- 4:26Anatomy of an Attestation
- 5:36Open Source Tools
- 6:11Example Architecture
- 6:57Continuous Feedback
- 7:26Attestation Example
- 8:33Our Approach: A Simple, Shared Language
- 13:19Scorecards
- 14:00Enforcement
- 15:40Opportunities
related talks
31mWrangling Compliance in the Wild West of Software Delivery
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
37mDevOps - The Automation of Compliance
25mDe-risking Deployments in an AI World
22mPutting Governance Into your DevOps Processes
48mDesigning a Secure Software Development Lifecycle with DevOps
05mHow To Automate Compliance If You Aren't Chuck Norris
33mCompliance as Code - Lessons Learned From Regulated Organizations